Which versions of Dotvvm are affected by CVE-2026-57578?

We need answer JSON only. Need synthesize. Must include all fields strings, data_quality_flags array? It says JSON array but every field plain text string?. A patch is available.

Is there a patch available for CVE-2026-57578?

Yes, a patch is available for CVE-2026-57578. Update the affected software to the latest version immediately.

Dotvvm CVE-2026-57578

Q: What is the CVSS score of CVE-2026-57578?

CVE-2026-57578 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-77700 CRITICAL

Missing Authorization (CWE-862)

2026-09-14 GitHub_M

Authentication Bypass Dotvvm

9.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Sep 15, 2026 - 11:24 vuln.today

Analysis Generated

Sep 15, 2026 - 11:24 vuln.today

Patch available

Sep 14, 2026 - 19:03 EUVD

CVE Published

Sep 14, 2026 - 17:39 cve.org

CRITICAL 9.2

DescriptionCVE.org

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.